Malware problems.. Logs and photos attached.

Welcome to Major Geeks!

Not acceptable! You MUST uninstall ALL except one antivirus program or they will still conflict and cause problems fighting for control of security center and and they will slow your PC down. If you want to keep Avast, you must uninst AVG, Adware ( garbage anyway ) and Microsoft Security Essentials and then reboot.

You need to attach the proper log from MGtools. Do not make your own as you attempted to do. The only log is C:\MGlogs.zip as stated in the instructions. It is not in the C:\MGtools folder.

If you shutdown Firefox and only use Internet Explorer, do you have the problems you are mentioning?

 

You're welcome. I have a couple more questions I need answers to.

What about when using Google Chrome that I see you have installed.

Is the below something you knowingly installed?
Hyperionics DB Toolbar

If not then uninstall it. If it is, what is for?

The below is questionable software, do you really need it? If not then uninstall it too:
Fantapper Player


Now run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
O2 - BHO: uTorrentBar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
O2 - BHO: WeCareReminder - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll

After clicking Fix, exit HJT.


Now uninstall all of the below:
Ad-Aware Browsing Protection
Conduit Engine
Java(TM) 6 Update 29
uTorrentBar Toolbar


We are going to be uninstalling your old version of Mozilla Firefox 14.0.1 (x86 en-US) and installing the new version. So do the below to save bookmarks:

• Run FireFox and click Bookmarks.
• Then select Organize Bootmarks.
• Then on the next window click File and then select Export. Save the bookmarks.html file to your Desktop for later use in importing.

Now download and save the installer for the current version of FireFox but DO NOT install it yet. Get it here: Mozilla Firefox 15.0.1 Final

You will need exit FireFox now and use Internet Explorer to continue with the below until we reinstall FireFox.

Start by uninstalling FireFox and then reboot. Do not skip the reboot and if it prompts you about saving settings, say No!!!

After reboot, delete the below folders if they still exist:
C:\Program Files (x86)\Mozilla Firefox
C:\Users\William\AppData\Roaming\Mozilla

Now reinstall FireFox from the file previously downloaded.
Import your bookmarks file. (similar process to exporting).


Now install the current version of Sun Java from: Sun Java Runtime Environment


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're welcome.

Try using the below tool to uninstall things you had a problem uninstalling:
Revo Uninstaller

Anything not found or still not remove, should be cleaned up with the rest of the below.

I also just notice the below which you should uninstall:
Yontoo Layers Runtime 1.10.01

Not according to your logs. At least not completely. It still shows even in your most recent log. We may have to finish it off manually.

I don't trust anyone to handle my personal data accept me. Anything being sent over the internet can also be intercepted. How do you know for 100% certainty that the PCs you are sending your data to are free from any infections? How do you know you can really trust all of their employees to never make a mistake with your personal data?

I'm not saying they are malicious. I'm just saying I would trust myself more than them.

Favorites take up an insignificant amount of space. Just save them your own CD and periodically make a new one as necessary. You don't need to waste any time or money doing this on the internet. That's a total waste in my opinion.


Now uninstall the below old versions of software:
Java(TM) 6 Update 24 (64-bit)

Now install the current version of Sun Java from: Sun Java Runtime Environment

You need to download and run CCleaner to cleanup temp files as requested in step 5 of the READ & RUN ME.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
O2 - BHO: Fantapper - {8A86D350-37AB-410A-8531-7D1363F317B3} - C:\Program Files (x86)\Brand Affinity Technologies\Fantapper Player\\IEInstaller.dll (file missing)
O23 - Service: Fantapper Player Update Service (FTSvc) - Unknown owner - C:\Program Files (x86)\Brand Affinity Technologies\Fantapper Player\FantapperUpdateService.exe (file missing)

After clicking Fix, exit HJT.

Please download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe and select Run as administrator to run it.
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
:Services
FTSvc
 
:Files
C:\Program Files (x86)\Brand Affinity Technologies
C:\Program Files (x86)\ConduitEngine
C:\Program Files (x86)\uTorrentBar
C:\ProgramData\AVG2012
C:\ProgramData\Babylon
C:\ProgramData\WeCareReminder
C:\Users\William\AppData\Local\Temp\{25f21f49-d676-4930-bf18-56ce40ee5668}
C:\Users\William\AppData\Local\Temp\{283F642A-BF07-473E-A4EF-E760E090E9D4}
C:\Users\William\AppData\Local\Temp\{5E9B1942-07FA-48D4-BB71-05FF3676B525}
C:\Users\William\AppData\Local\Temp\{DD0BBE2E-0524-4ECB-9C7F-F9C935F8A4A6}
C:\Users\William\AppData\Local\Temp\~DF7A2284AC72548C07.TMP
 

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A86D350-37AB-410A-8531-7D1363F317B3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentBar Toolbar]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Aware Browsing Protection]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine ]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.


Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the C:\_OTM\MovedFiles log
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You should have used the link I gave you in our cleaning procedure to download from Major Geeks!

We DO NOT recommend using any registry cleaners nor any performance tweakers. They are typically not needed. And registry cleaning frequently causes more problems then it fixes and many times you do not see the negative effects for awhile. We have had quite a few people coming here complaining about malware slowing there PC down, or about software not running properly or crashing, or Windows crashing, or even Windows Update not working. Many times this was due to using registry cleaners that remove many things that are not problems and should not be touched. The PC I'm typing on has been running Windows XP since it first came out and has never needed any registry cleaning. It still runs perfectly fine.

The only excpeption to using registry cleaners would be if an expert like myself asked you to run a cleaner and then specifically told you what to fix and what to ignore.

Your logs are clean.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You're welcome. Surf safely!